CVE-2018-11307: Deserialization of Untrusted Data in jackson-databind
Summary
CVE-2018-11307: Deserialization of Untrusted Data in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.0.0, < 2.7.9.4
>= 2.8.0, < 2.8.11.2
>= 2.9.0, < 2.9.6
Fixed in 2.7.9.4, 2.8.11.2 or 2.9.6, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-11307 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library used for converting Java objects to JSON and vice versa. It provides functionality for data binding, which allows developers to map JSON data to Java objects and vice versa. This vulnerability affects versions 2.0.0 through 2.9.5 of the jackson-databind package.
Vulnerability Detail
The vulnerability (CVE-2018-11307) arises from the use of Jackson default typing along with a gadget class from iBatis. It allows an attacker to exploit the deserialization process and exfiltrate content from the application. This can lead to unauthorized access, data leakage, and potential remote code execution. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.7.9.42.7.9.4 -
>= 2.8.0, < 2.8.11.22.8.11.2 -
>= 2.9.0, < 2.9.62.9.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of the jackson-databind package.
Conclusion
The vulnerability (CVE-2018-11307) in the jackson-databind package allows for the deserialization of untrusted data, leading to potential unauthorized access, data leakage, and remote code execution. It is crucial to upgrade to the fixed versions of the package to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson-databind is a Java library used for converting Java objects to JSON and vice versa. It provides functionality for data binding, allowing developers to map JSON data to Java objects and vice versa.
This vulnerability allows an attacker to exploit the deserialization process and exfiltrate content from the application. It can lead to unauthorized access, data leakage, and potential remote code execution.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of the jackson-databind package. Please refer to the 'how_to_fix' section for specific version information.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of the jackson-databind package.
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
